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1 
FLIGHT CONTROL SYSTEM AND 
AIRCRAFT COMPRISING IT 


BACKGROUND OF THE INVENTION 


This invention relates to flight control systems (Flight Con- 
trol Systems) present in aircraft. 

These flight control systems are at the interface between 
the flying components (control stick, rudder bar, etc.) and the 
various movable flight surfaces of the aircraft (such as the 
rudders, elevators, ailerons, stabilizers, etc.). 

Modern airliners have flight control systems of “fly by 
wire” type in which mechanical actions on the flying compo- 
nents are converted into signals transmitted to actuators con- 
trolling the movement of the flight surfaces, these commands 
being transmitted to the actuators by advanced computers. 

These commands are computed according to several types 
of laws. One of these laws, called normal law, is an assisted 
flying law that reprocesses the flying instructions provided by 
the flying components in order to optimize flying conditions 
(passenger comfort, stabilization of the airplane, protection 
of the performance envelope, etc.). Another law, referred to as 
direct law, is a law that only retranscribes the instructions for 
movement of the airplane transmitted by the electrical flight 
controls without reprocessing these signals with a view to 
improving flying performance. 

There already is known, as illustrated on FIG. 1, a flight 
control system 1 comprising a control module 2 having two 
sets of computers 4 and 5 in order to determine the control 
commands to be transmitted to actuators 3. 

Set 4 comprises two computers 4-1 and 4-2 able to compute 
the control of actuators 3 established according to the normal 
and direct control laws (these computers are called primary 
computers) and a computer 4-3 only able to compute this 
control established according to the direct law (this computer 
is called secondary computer). 

Set 5 comprises one primary computer 5-1 and two sec- 
ondary computers 5-2 and 5-3. 

All these computers are installed in an avionic bay and 
communicate with the actuators via direct point-to-point ana- 
log links. 

The actuators are connected to one or two computers, with 
in the case of two computers a “master/standby” architecture, 
the master computer ascertains the validity of the control 
signal transmitted to the actuator which ensures the integrity 
of the device. When the master computer breaks down, the 
“standby” computer takes over, which ensures that a com- 
puter is always available. 

In order to ascertain the validity of its command, each 
computer has a structure with a dual computation unit (it is a 
matter of dual-track computers also called “duplex” comput- 
ers), not illustrated on FIG. 1. 

The first unit is a control unit (COM) which implements the 
processing necessary for performance of the functions of the 
computer, namely to determine a control signal to an actuator. 

The second unit is a monitoring or checking unit (MON) 
which for its part carries out the same types of operations, the 
values obtained by each unit then being compared and, if 
there is a deviation that exceeds an authorized tolerance 
threshold, the computer is automatically disabled. It then 
becomes inoperative and is declared faulty so that another 
computer may take its place in order to implement the func- 
tions abandoned by this faulty computer. 

Each computer thus is designed for detecting its own fail- 
ures and inhibiting the corresponding outputs while signaling 
its condition. 
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The hardware of the primary and secondary computers is 
different so as to minimize the risks of simultaneous failure of 
all the computers (hardware dissimilarity). 

In addition, the hardware of the two tracks (COM and 
MON) of each computer is identical but for reasons of safety, 
the software packages of these two tracks are different so as to 
ensure a software dissimilarity. 


SUMMARY OF THE INVENTION 


The invention is intended to provide a flight control system 
which has an architecture modified in relation to that of the 
prior art descried above, at the same time less costly in hard- 
ware and software resources while meeting the same safety 
and availability requirements as the system of the prior art. 

To this end, the invention proposes a flight control system 
for an aircraft, in which control commands are transmitted 
between a flight control module and at least one actuator of a 
movable flight surface, the flight control module comprising 
at least one first and one second computer, each computer 
being adapted for computing, for each actuator, a control 
command established according to at least one predetermined 
law for control of the flight surface controlled by the actuator. 

In accordance with the invention, the proposed system is 
noteworthy in that each actuator comprises at least two logic 
units adapted for receiving commands originating from all the 
computers, each logic unit being adapted for: 

comparing between them the commands received, and 

according to the result of the comparison, choosing in 
accordance with a predetermined choice logic common 
to all the actuators, a computer, referred to as master 
computer, whose control command is validated for 
execution by the actuator considered; and 

transmitting, to all the computers, a master computer 

choice information item; 

and in that each computer is adapted for self-determining 
as being a master computer or otherwise as being a computer 
referred to as slave, on the basis of master computer choice 
information items received from all the actuators, a sole mas- 
ter computer among all the computers finally being deter- 
mined. 

The implementation, in each of the logic units of each 
actuator, of the same logic for choice of a master computer, 
associated with the use of computers capable of being self- 
determining as master or slave computer on the basis of 
choice information items transmitted by the actuators, makes 
it possible to end up with the choice of a single master com- 
puter for all the actuators. 

Furthermore, in the system according to the invention, 
since the comparison of the commands from the computers 
no longer is carried out at these computers but at each actua- 
tor, each actuator thus is able to determine by itself, on the 
basis of the computer commands that are transmitted thereto, 
the action to be executed on the movable flight surface (in 
practice, the amplitude of movement of this surface), that is to 
say the one corresponding to the control command of the 
computer chosen as master. 

In this way each actuator also is able, by virtue of the logic 
units that it comprises, to determine which commands to use 
as a basis in order to define the action to be executed and to 
reject the commands whose comparison with the other com- 
mands shows that they present an anomaly. 

According to a specific characteristic of the invention, each 
computer comprises verification means adapted for verifying, 
for each actuator, the coherence of the master computer 
choice information items obtained respectively from each of 
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the logic units of the actuator considered, and if said infor- 
mation items are not coherent, for ignoring these information 
items. 


In this way, if the logic units associated with an actuator 
choose different master computers— which indicates a prob- 
able malfunction of the actuator—the choice information 
items transmitted by this actuator are not taken into account 
by the computers in order to self-determining as master or 
slave. 


According to another characteristic of the invention, if the 
choice of master computer made by each logic unit of a given 
actuator is the same, the control command of the master 
computer chosen is executed by the actuator, otherwise the 
actuator is disabled. 


Thus, since the determination of the action to be executed 
is moved to the actuator, this also makes it possible to produce 
simpler and less costly computers while providing a greater 
flexibility for layout of the system. This makes it possible, in 
particular, to be free from the “COM/MON” and “master/ 
standby” architectures of the prior art, which significantly 
minimizes the total number of computers, while retaining a 
high level of safety. 


According to another characteristic of the invention, each 
computer comprises a control string including at least one 
integrator, each computer being adapted, when it is self- 
determined as being a slave computer, for synchronizing the 
integrator of its control chain with that of the master computer 
finally determined. 


By automatically synchronizing the integrators of the slave 
computers with those of the single master computer, accord- 
ing to the invention, the possible divergence of the integrators 
of the slave computers thus is remedied. In fact, the servo- 
control loops, including the integrators, of the master com- 
puter are stable since the commands are applied by the actua- 
tors and the airplane responds physically to the servo-control; 
on the other hand, since the commands generated by the slave 
computers are not applied, their integrator may diverge. 


Furthermore, the characteristic according to which a sole 
master computer is finally chosen associated with the char- 
acteristic according to which the other computers (slaves) are 
synchronized automatically with the single master computer, 
endows the invention with more simplicity in comparison 
with the prior art, while retaining a high level of safety. 


According to optional characteristics of the invention: 


the logic units of each actuator also are adapted, for each 
computer, for sending back or not sending back a mes- 
sage of failure of the computer, according to the result of 
the comparison of commands. 


the system comprises a plurality of actuators and each 
computer is adapted for disabling itself when it receives 
failure messages originating from a number of actuators 
exceeding a predetermined number. 


Since the actuators are able to compare the commands of 
the computers among themselves, they are capable of detect- 
ing which computers are faulty and of sending a message 
back to them to so inform them. 


In the system according to the invention, the functions 
carried out by the MON unit of the duplex structure comput- 
ers of the prior art thus are implemented by the actuators 
jointly with the other computers by virtue of which it becomes 
possible to use computers which have only one track (com- 
puters referred to as “simplex,” that is to say devoid of redun- 
dant processors) instead of two (“duplex” computers). 
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According to still other characteristics of the invention: 

each comparison of commands carried out by an actuator 

logic unit concerns commands originating from com- 
puters computing their control command according to a 
different program; 

on the other hand, the logic units of each actuator also are 

adapted, when all the still operational computers are 
computing the control command according to the same 
program, for sending a request for software reconfigu- 
ration to one of the still operational computers so that it 
may function according to a program different from that 
of the other still operational computers. 

In this way, on the one hand, the taking into account of the 
software dissimilarity of the computers for comparison of the 
commands makes it possible to increase the reliability of the 
system and, on the other hand, the software reconfiguration 
makes it possible to maximize the use of each computer, 
which contributes to minimizing the total number of comput- 
ers while retaining, for the same control law, a software 
dissimilarity among computers. 

According to still other embodiment characteristics of the 
invention: 

each actuator comprises a control unit and a unit for moni- 

toring the control unit; 

each unit is connected to the first computer and to the 

second computer; and/or 

one of the units is only connected to the first computer and 

the other unit is only connected to the second computer, 
the control and monitoring units also being connected to 
each other. 

Contact of the control and monitoring units of the actuators 
with the sets of computers thus may be implemented directly 
or indirectly (through the other unit). 

According to a second aspect, the invention also applies to 
an aircraft equipped with a flight control system such as 
explained above. 


BRIEF DESCRIPTION OF THE DRAWINGS 


The explanation of the invention now will be continued 
with the detailed description of an exemplary embodiment, 
presented below with an illustrative but non-limitative intent, 
with reference to the attached drawings, on which: 

FIG. 1 is a schematic representation of a flight control 
system according to the prior art described above; 

FIG. 2 is a schematic view of a flight control system 
according to the invention; 

FIG. 3 is a view detailing the communication network 
allowing transfer of information from sets of computers that 
comprise the system according to the invention to the actua- 
tors of this system; 

FIG. 4 is a view similar to FIG. 3 but for a variant of the 
communication network; and 

FIG. 5 schematically illustrates the principle of synchro- 
nization of the MON track with the COM track in a computer 
according to a COM/MON architecture of the prior art. 


DETAILED DESCRIPTION OF THE INVENTION 


A flight control system 11, according to an embodiment of 
the invention illustrated on FIG. 2, presents a control module 
12 for transmitting commands to a plurality of actuators 13. 

Control module 12 comprises six “simplex” computers 
(they have only one track and one computation processor) 
distributed in two sets 14 and 15 of three computers (FCC, 
Flight Control Computer), each set being connected to each 
of actuators 13 (FCRM, Flight Control Remote Module). 
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Set of computers 14 (respectively 15) communicates with 
actuators 13 via a digital data-exchange component 16 (re- 
spectively 17) the structure of which will be explained in 
detail below with the aid of FIGS. 3 and 4. 

Set of computers 14 (respectively 15) comprises two pri- 
mary computers (PRIM for PRIMary flight control and guid- 
ance computer) 14-1 and 14-2 (respectively 15-1 and 15-2) 
making it possible to compute control commands according 
to the normal law and according to the direct law as well as a 
secondary computer (SEC for SECondary flight control com- 
puter) 14-3 (respectively 15-3) for computing control com- 
mands on the basis of the direct law alone. 

The primary and secondary computers are of different 
hardware design so as to meet safety requirements (hardware 
dissimilarity). 

Primary computers 14-1 and 14-2 (respectively 15-1 and 
15-2) function with two program variants A and B for com- 
putation according to the normal and direct laws which are 
different from one another, while computer 14-3 (respec- 
tively 15-3) functions for computation according to the direct 
law with a program variant C different from variants A and B. 

In this way computation according to the normal law is 
achieved by two different programs (A and B) while compu- 
tation according to the direct law also is achieved by two 
different programs (B and C or A and C or A and B). Software 
dissimilarity therefore is effectively ensured for determina- 
tion of control signals, which ensures a high level of safety. 

As will be seen below, each computer may be reconfigured 
on the spot according to failures. 

These sets of computers are located in an avionic bay (the 
avionic bay is the space in which most of the electronic 
equipment items of an airplane are grouped together, gener- 
ally situated underneath the useful space of the airplane) and 
are supplied by two separate electrical systems. 

Each actuator 13 comprises two tracks 18 and 19 (COM 
track and MON track) connected to two sets of computers 14 
and 15 so that each actuator communicates via its tracks 18 
and 19 with all the computers. 

Track 18 (control unit COM) performs voting and selection 
functions and track 19 (monitoring unit MON) for its part 
carries out the same types of operations so that, at the end, the 
values obtained by each unit are compared and, in case of 
disagreement, the actuator is disabled. 

According to the logic architecture of actuators 13, referred 
to as “architecture with master computer selected by the 
actuators,” all the computers (primary and secondary) of the 
two sets of computers 14 and 15 compute the flying laws in 
order to generate commands for control of the movable flight 
surfaces. At each cycle, each computer computes the instruc- 
tions for all the valid actuators, and transmits the commands 
via components 16 and 17 to all units 18 and 19 of all the 
actuators and this irrespective of the validity of the commands 
computed by each computer. 

In the example illustrated, each actuator 13 therefore 
receives per set of computers two commands for the normal 
law (originating from computers 14-1 and 14-2 for set 14 and 
from computers 15-1 and 15-2 for set 15) and three com- 
mands for the direct law (originating from computers 14-1 to 
14-3 for set 14 and from computers 15-1 to 15-3 for set 15), so 
that, before the first failure, each actuator 13 has four instruc- 
tions for the normal law and six instructions for the direct law. 

From all these instructions, each of the two logic units 18 
and 19 of each actuator 13 performs voting operations. 

The voting algorithm is based on the commands from the 
computers and is implemented in each unit 18 and 19 (COM 
or MON) of each of the actuators (FCRM). 
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Each of the logic units 18 and 19 (COM and MON) of each 
actuator 13 (FCRM) compares two by two the commands 
received from all the computers (FCC) 14-i, 15-i (1-1, 2, 3). 

According to the exemplary embodiment described, two 
commands intended for the same movable surface to be actu- 
ated and originating from two separate computers (FCC) are 
considered as coherent or incoherent depending on whether 
their difference (in absolute value) is above or below a pre- 
defined monitoring threshold (marked Delta), for a pre- 
defined period, referred to as confirmation period. 

According to the invention, in order to guarantee the taking 
into consideration of the software dissimilarity of the com- 
puters, each comparison of commands concerns commands 
originating from computers equipped with a different soft- 
ware package. 

According to the invention, two command comparison 
functions are defined, marked CL-Normal(FCCx, FCCy) and 
CL-Direct(FCCx, FCCy) defined as follows. 

The function CL-Normal(FCCx, FCCy) is intended to 
determine the coherence for the normal law of commands 
originating from computers FCCx and FCCy, while the func- 
tion CL-Direct(FCCx, FCCy) is intended to determine the 
coherence for the direct law of commands originating from 
computers FCCx and FCCy. In practice, the aforesaid func- 
tions send back the values ‘TRUE’ or ‘FALSE’ depending on 
whether the two commands compared are coherent or not. 

According to the embodiment explained: 

The function CL-Normal(FCCx, FCCy) sends back the 
value ‘FALSE?’ if: 

The command for the normal law of computer FCCx is not 

available, OR 

The command for the normal law of computer FCCy is not 

available, OR 

The difference (in absolute value) between the two com- 

mands for the normal law of computers FCCx and FCCy 
is greater than monitoring threshold Delta, confirmed 
during a certain time T, and locked beyond time T' 
greater than T. The parameters Delta, T and T' are 
adjusted beforehand. 

Otherwise the function CL-Normal(FCCx, FCCy (sends 
back the value ‘TRUE.’ 

Similarly, the function CL-Direct(FCCx, FCCy) sends 
back the value ‘FALSE?’ if: 

The command for the direct law of computer FCCx is not 

available, OR 

The command for the direct law of computer FCCy is not 

available, OR 

The difference (in absolute value) between the two com- 

mands for the direct law of computers FCCx and FCCy 
is greater than the monitoring threshold Delta, con- 
firmed during a certain time T, and locked beyond time 
T' greater than T. 

Otherwise the function CL-Direct(FCCx, FCCy) sends 
back the value ‘TRUE.’ 

It will be noted here that the fact that the command from a 
computer may not be available for the normal law or the direct 
law corresponds in particular to a self-declared failure situa- 
tion of the computer concerned. 

By using the two comparison functions defined above, 
each of the logic units (COM or MON) 18 and 19 of any 
actuator, determines a master computer (FCC), that is to say 
the computer whose command to be applied, according to a 
predetermined choice logic used by the logic units of all the 
actuators, an example of which is synthesized by the table 
provided below: 
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MASTER TYPE 

CONDITION COMPUTER OF LAW 
C1. If CL-Normal(FCC 14-1, FCC 15-2) is FCC 14-1 Normal 
TRUE, then: 
C2. Otherwise, if CL-Normal(FCC 14-1, FCC 14-2 Normal 
FCC 14-2) is TRUE, then: 
C3. Otherwise, if CL-Normal(FCC 15-1, FCC 15-1 Normal 
FCC 14-2) is TRUE, then: 
C4. Otherwise, if CL-Normal(FCC 15-1, FCC 15-2 Normal 
FCC 15-2) is TRUE, then: 
C5. Otherwise, if CL-Normal(FCC 14-1, FCC 14-1 Normal 
FCC 15-1) is TRUE after reconfiguration of 

he software of FCC 15-1 as software ‘B, 

hen: 
C6. Otherwise, if CL-Normal(FCC 14-2, FCC 15-2 Normal 
FCC 15-2) is TRUE after reconfiguration of 

he software of FCC 15-2 as software ‘A,’ 

hen: 
C7. Otherwise, if CL-Direct(FCC 14-3, FCC FCC 14-3 Direct 

5-3) is TRUE, then: 
C8. Otherwise, if CL-Direct(FCC 14-1, FCC FCC 14-1 Direct 

5-2) is TRUE, then: 
C9. Otherwise, if CL-Direct(FCC 14-1, FCC FCC 14-2 Direct 
4-2) is TRUE, then: 
C10. Otherwise, if CL-Direct(FCC 15-1, FCC 15-1 Direct 
FCC 14-2) is TRUE, then: 
C11. Otherwise, if CL-Direct(FCC 15-1, FCC 15-2 Direct 
FCC 15-2) is TRUE, then: 
C12. Otherwise, if CL-Direct(FCC 14-1, FCC 14-1 Direct 
FCC 14-3) is TRUE, then: 
C13. Otherwise, if CL-Direct(FCC 14-2, FCC 14-2 Direct 
FCC 14-3) is TRUE, then: 
C14. Otherwise, if CL-Direct(FCC 15-1, FCC 15-1 Direct 
FCC 14-3) is TRUE, then: 
C15. Otherwise, if CL-Direct(FCC 15-2, FCC 15-2 Direct 
FCC 14-3) is TRUE, then: 
C16. Otherwise, if CL-Direct(FCC 14-1, FCC 14-1 Direct 
FCC 15-3) is TRUE, then: 
C17. Otherwise, if CL-Direct(FCC 14-2, FCC 14-2 Direct 
FCC 15-3) is TRUE, then: 
C18. Otherwise, if CL-Direct(FCC 15-1, FCC 15-1 Direct 
FCC 15-3) is TRUE, then: 
C191. Otherwise, if CL-Direct(FCC 15-2, FCC 15-2 Direct 
FCC 15-3) is TRUE, then: 


The choice logic illustrated by the above table takes into 
account the degradation of the laws, since the normal law is 
favored in relation to the direct law (degraded law), the 
instructions shown by the table to be applied according to a 
descending priority from high to low starting from the first 
line or condition in the table. Thus, if a condition Ci produces 
the result “FALSE,” the following condition Ci+1 is tested, 
and so on, up to the condition for which the result is “TRUE.” 
The master computer selected then is the one corresponding 
to this last condition. 

Although an actuator (FCRM) may be affected only by the 
command governing the functioning of the control surface 
that it controls, according to the invention each actuator 
receives all the commands transmitted by each of the com- 
puters (FCC), that is to say the commands intended for all the 
control surfaces of the airplane. Consequently, each actuator 
performs its own selection of a master computer by taking 
into account all the information items transmitted by the 
computers, and as soon as two computers are mutually inco- 
herent for a given command, these computers then are con- 
sidered by the actuator as being incoherent as a whole, that is 
to say incoherent for all the commands received, and the 
following condition in the list of priorities (above table) is 
systematically examined. 

As all the logic units ofthe actuators use the same selection 
logic on all the commands received from the computers, in the 
end a single master chosen by all the valid actuators is 
obtained. 
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Inthe exemplary logic provided above, it will be noted that 
the master computer chosen advantageously varies from one 
condition to another. 

In fact, when a master computer breaks down, that is to say 
transmits an erroneous command, the latter is applied by all 
the control surfaces of the airplane, which generally causes a 
swerving of the airplane (undesired performance). Very rap- 
idly, as soon as the detection threshold (monitoring threshold) 
of the failure is reached, the current condition “jumps” and 
the following condition (in the table) is taken into account, a 
new master computer then is selected. Consequently, the 
command applied to the aircraft becomes valid again and 
sound performance of the airplane is restored. 

If for example, in the above table, two successive condi- 
tions might lead to selection of the same master computer, in 
the event of failure of this computer, the time for return to a 
sound performance ofthe airplane therefore would be longer, 
since it would be necessary to process two successive condi- 
tions in order to change the master computer, instead of only 
one according to the invention. 

Once the selection of the master is made, each of the logic 
units (18, 19) COM and MON transmits to all the computers 
an information item identifying the master computer chosen. 

According to a specific embodiment of the invention, it 
may be provided that once a master computer is selected, each 
actuator (FCRM) performs an additional verification consist- 
ing in comparing the commands of all the non-master com- 
puters with those of the master computer and, in the event of 
deviation confirmed by comparing commands, the computer 
whose command shows the confirmed deviation is perma- 
nently excluded (locked). 

On the other hand, if the choice of master computer made 
by each logic unit (18, 19) of a given actuator is the same, the 
control command of the master computer chosen is executed 
by the actuator, otherwise the actuator is disabled. An actuator 
whose two logic units MON and COM have chosen the same 
master computer is designated in the context of this explana- 
tion as “coherent actuator." 

As far as computers are concerned, each valid computer 
(14-1, 14-2, 14-3, 15-1, 15-2, 15-3) receives the master com- 
puter choice information items received from all the actua- 
tors, and self-determines as being the master computer if the 
information items that it receives identify it as such; other- 
wise it self-determines as being a non-master computer, des- 
ignated as “slave computer.” Given that the choice informa- 
tion items are transmitted by all the logic units of all the valid 
actuators, in order to determine itself as a master computer or 
not, each computer first verifies, for each actuator, the coher- 
ence of the master computer choice information items 
obtained respectively from each of the logic units of the 
actuator considered, and if the said information items are not 
coherent, the actuator is declared “incoherent,” and the infor- 
mation items originating from the actuator considered are 
ignored. 

Furthermore, as mentioned above, it will be noted that the 
choice logic illustrated by the above table takes into account 
the software dissimilarity of the computers, since each com- 
parison concerns commands originating from two computers 
equipped with a different software package. For example, for 
the first condition (C1), commands originating from comput- 
ers 14-1 and 15-2 which are respectively equipped with pro- 
grams A and B for the normal law (see FIG. 2), are compared. 
On the other hand, each logic unit (18, 19) of a given actuator 
(13) is adapted, when all the still operational computers are 
computing the control command according to the same pro- 
gram, for sending a request for software reconfiguration to 
one of the still operational computers so that it may function 
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according to a program (software A or B) different from that 
of the other still operational computers. 

At each cycle of reception of control commands transmit- 
ted by the computers, each COM or MON unit of the actua- 
tors verifies the choice conditions according to the order of 
priority. If according to the order of priority, conditions C1 to 
C4 tested successively produce the result ‘FALSE, in this 
case computers 14-1 and 15-1 are considered as being faulty. 
In addition, as none of conditions C1 to C4 is met, none of 
primary computers 14-1, 14-2, 15-1, 15-2 can be chosen as 
master computer for the normal law, therefore all actuators 
(FCRM) go over to direct law mode on testing condition C7. 

The two conditions C5 and C6 are applied for a following 
cycle only after software reconfiguration of computer 15-1 as 
software B or of computer 15-2 as software A, respectively. 

For example, if computers 14-1 and 15-1 are declared lost 
(self-detected failure), then only primary computers 14-2 and 
15-2, which are equipped with the same computation soft- 
ware, B, are available any more. In this case, all actuators 
(FCRM) send to computer 15-2 a request for software recon- 
figuration as software version A. 

Computer 15-2 identifies at least one request for reconfigu- 
ration as being valid, according to an exemplary embodiment, 
because the request originates from a “coherent” actuator, 
that is to say an actuator whose master choice information 
items are coherent between two logic units of the actuator. 
The computer, in this example computer 15-2, is reconfigured 
as software A, then sends to actuators (FCRM) an information 
item indicating that it is reconfigured as software A. 

During the following cycle of reception of commands, 
condition C6 on the table may give rise to a ‘TRUE’ result 
since computer 15-2 has been reconfigured as software A. In 
this case, the master computer selected may be computer 
(FCC) 15-2 and the law applied again will become the normal 
law. 

Similarly, if computers 14-2 and 15-2 which are function- 
ing with software B are declared faulty, a request for software 
reconfiguration as software B will be sent to computer 15-1, 
so that condition C5 in the table may be applicable. 

It will be noted that the problem of absence of software 
dissimilarity does not arise for computation of the direct law 
because this law may be computed by each of the computers 
according to three programs (A, B or C), so that even if two 
computers functioning with the same program break down, 
the software dissimilarity is still retained (A and B, A and C, 
or B and C). 

The logic for selection of a master computer explained 
above is provided by way of example only; it may be pro- 
vided, for example, to use any similar choice logic obtained 
by circular permutation of computers (FCC) whose com- 
mands are compared. 

Furthermore, it also may be provided to use a different 
selection logic for actuators (FCRM) in charge of lateral 
control (which would select a master FCC for the lateral 
normal law) and for the longitudinal control actuators (which 
would select a master FCC for the longitudinal normal law). 

An exemplary communication network between the com- 
puters of module 12 and actuators 13 now is going to be 
described with the aid of FIG. 3. 

This network comprises two data exchange components 16 
and 17. 

Component 16 (respectively 17) comprises two elements 
16-1 and 16-2 (respectively 17-1 and 17-2), each element 
comprising a 100 Mbit/s AFDX (Avionics Full DupleX 
switched ethernet) bus, situated in an avionic bay or else- 
where in the fuselage of the airplane and connected to a 
micro-bus (with an output of 10 Mbits/s) situated near the 
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actuators (these buses are not illustrated on the Figure). These 
buses were developed and standardized to meet the specifi- 
cations for the aeronautical field. 

The AFDX networks are based on the principle of switched 
networks, that is to say that the actuators and the computers in 
charge of data transmission or reception are organized around 
switches through which these data pass in transit. 

These networks form a digital link between the computers 
and the actuators, the multiplexing of data achieved in this 
way making it possible to have each computer communicate 
easily with each actuator (which was not the case with the 
device of the prior art where the links between the computers 
and the actuators were point-to-point analog links). 

Each component 16 and 17 is connected to each unit 18 and 
19 of each actuator 13, so that each unit 18 and 19 is directly 
connected with each computer via the AFDX and micro-bus 
buses. 

In a variant illustrated on FIG. 4, unit 18 of each actuator is 
only connected to one of the sets of computers while unit 19 
is connected to the other of the sets of computers, with units 
18 and 19 which are connected to one another so that, all the 
same, unit 18 may communicate with the set of computers to 
which it is not directly connected through unit 19 and vice 
versa. 

As a variant, units 18 and 19 of each actuator may share the 
same mediums for communicating with the computer, by 
using CRCs (Cyclic Redundancy Check) referred to as appli- 
cative, for signing their messages. 

It also is possible to use other types of buses such as ARINC 
(Aeronautical Radio INCorporated) buses or any other type 
of communication component allowing digital multiplexing 
between the computers and the actuators, provided that these 
are compatible with the specifications in the aeronautical 
field. 

In still another variant, it is not the normal and direct laws 
that are implemented in the computers, but any other type of 
law such as, for example, a law which, unlike the direct law, 
would be only partially degraded in relation to the normal law 
(following loss of signals from the airplane sensors, for 
example). 

Finally, it will be recalled that the number of computers is 
variable according to needs and is not limited to the number 
described in the examples illustrated on FIGS. 2 to 4. 

FIG. 5 schematically illustrates the principle of synchro- 
nization of the MON track with the COM track in a computer 
according to a COM/MON architecture of the prior art. 

The normal law seeks to slave a flight parameter of the 
airplane (load factor, attitude, roll rate, . . . ) to an instruction 
(resulting from the command of the pilot or of the automatic 
pilot). For the purpose of improving the precision of these 
servo-controls, integrators are installed within the control 
strings of the computers, in order to cancel out static error. As 
the servo-control for the MON unit is not executed (open 
loop) and it comprises integrators, the latter eventually may 
shift (integration of a given fixed deviation). In order to over- 
come this divergence of the integrators of the MON units, the 
latter are synchronized with the outputs of integrators of the 
COM unit, as shown on FIG. 5. 

In the context of this invention, in order to respond to this 
synchronization problem, each computer is adapted, when it 
is self-determined as being a slave computer, for synchroniz- 
ing the integrator of its control string with that of the finally 
determined master computer. In the embodiment described 
and illustrated, this synchronization takes up the known 
method of synchronization, such as illustrated on FIG. 5. 

The flight control system according to the invention advan- 
tageously may be supplemented by an external computer, 
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designated as “diagnostic computer” dedicated to the identi- 
fication of computers (FCC) of the control system that are 
faulty. This diagnostic computer, for example a computer of 
known FCDC (Flight Control Data Concentrator) type, may 
consist of a partition of the integrated modular avionics 
(IMA Integrated Modular Avionics). 

According to the invention, it is provided that this addi- 
tional computer determines the master FCC computer 
according to the same choice algorithm as the one applied by 
the actuators (FCRM). Such a diagnostic computer is adapted 
for comparing the information items transmitted by all the 
FCC computers with the information items transmitted by the 
(sound) master FCC computer, which enables it to detect an 
FCC computer with erroneous performance. According to an 
exemplary embodiment, once the aforesaid comparison is 
made, the diagnostic computer displays on a display device, a 
screen for example, the functioning state of each FCC com- 
puter, for example by using the following classification: Mas- 
ter; sound Slave (coherent with the master); erroneous Slave 
(incoherent with the master); Lost (self-detected failure). 


The invention claimed is: 

1. A flight control system for an aircraft, in which control 
commands are transmitted between a flight control module 
and at least one actuator of a movable flight surface of the 
aircraft, the system comprising: 

at least one first and at least one second computer in the 

flight control module, each of the at least one first and 
second computers configured to compute, for each 
actuator, a control command established according to at 
least one predetermined law for control of the flight 
surface controlled by the actuator; 

each actuator includes at least two logic units configured to 

receive orders originating from all the computers of the 
flight control module, and each logic unit is configured 
to: 

compare the commands received between the at least two 

logic units, and according to the result of the compari- 
son, choose in accordance with a predetermined logic 
common to all the actuators, a master computer, whose 
control command is validated for execution by the actua- 
tor considered; and 

transmit, to all the computers, a master computer choice 

information item, 

wherein each computer of the flight control module is 

configured to determine whether it is a master computer 
or a slave computer, on the basis of master computer 
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choice information items received from all the actuators, 
and a sole master computer is determined from among 
all the computers. 

2. The flight control system according to claim 1, in which 
each computer of the flight control module includes a verifi- 
cation unit configured to verify, for each actuator, the coher- 
ence of the master computer choice information items 
obtained respectively from each of the logic units of the 
actuator considered, and if the information items are not 
coherent, to ignore these information items. 

3. The flight control system according to claim 1, wherein 
if the choice of the master computer made by each logic unit 
of a given actuator is the same, the control command of the 
master computer chosen is executed by the actuator, other- 
wise the actuator is disabled. 

4. The flight control system according to claim 3, wherein 
each computer includes a control string including at least one 
integrator, each computer configured to, when it is self-deter- 
mined as being a slave computer, synchronize the integrator 
of its control string with that of the master computer that is 
finally determined. 

5. The flight control system according to claim 1, wherein 
each comparison of commands concerns commands originat- 
ing from computers computing their control command 
according to a different program. 

6. The flight control system according to claim 1, wherein 
the logic units of each actuator are configured to, when all still 
operational computers are computing the control command 
according to a same program, send a request for software 
reconfiguration to one of the still operational computers so 
that it may function according to a program different from 
that of the other still operational computers. 

7. The flight control system according to claim 1, wherein 
the logic units of each actuator consist of a control unit and a 
monitoring unit for monitoring the control unit. 

8. The flight control system according to claim 7, wherein 
both the control unit and the monitoring unit are connected to 
the at least one first computer and to the at least one second 
computer. 

9. The flight control system according to claim 7, wherein 
one of the control unit and the monitoring unit is only con- 
nected to the at least one first computer and the other unit is 
only connected to the second computer, the control and moni- 
toring units also being connected to one another. 

10. An aircraft equipped with a flight control system 
according to claim 1. 


